Port scanning with Nmap in Cybersecurity - Step-by-Step Execution

Concept Flow - Port scanning with Nmap

Start Nmap Command

↓

Send Probe Packets to Target Ports

↓

Wait for Responses

↓

Analyze Responses

↓

Determine Port Status

↓

Display Scan Results

↓

End

Nmap sends small data packets to target ports, waits for replies, analyzes them to find which ports are open, closed, or filtered, then shows the results.

Execution Sample

Cybersecurity

nmap -sS 192.168.1.1

# Sends TCP SYN packets to scan common ports on the target IP

This command performs a stealthy TCP SYN scan on the target IP to find open ports.

Analysis Table

Step	Action	Packet Sent	Response Received	Port Status Determined	Output
1	Send SYN packet to port 22	SYN to port 22	SYN-ACK from port 22	Open	Port 22 is open
2	Send SYN packet to port 80	SYN to port 80	No response	Filtered	Port 80 is filtered
3	Send SYN packet to port 443	SYN to port 443	RST from port 443	Closed	Port 443 is closed
4	Send SYN packet to port 8080	SYN to port 8080	SYN-ACK from port 8080	Open	Port 8080 is open
5	Scan complete	No more packets	No more responses	Scan finished	Summary of open, closed, filtered ports
6	Exit	N/A	N/A	N/A	Nmap scan ends

💡 All target ports scanned; no more packets to send.

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Port 22 Status	Unknown	Open	Open	Open	Open	Open
Port 80 Status	Unknown	Unknown	Filtered	Filtered	Filtered	Filtered
Port 443 Status	Unknown	Unknown	Unknown	Closed	Closed	Closed
Port 8080 Status	Unknown	Unknown	Unknown	Unknown	Open	Open

Key Insights - 3 Insights

Why does no response from a port indicate it is filtered?

Because in the execution_table row 2, no response means the packet was likely dropped by a firewall, so Nmap reports it as filtered.

What does a SYN-ACK response indicate in the scan?

As shown in rows 1 and 4, a SYN-ACK means the port is open and ready to accept connections.

Why does Nmap send SYN packets instead of full connections?

Nmap uses SYN packets (half-open scan) to avoid completing the TCP handshake, making the scan stealthier, as seen in the execution_sample command.

Visual Quiz - 3 Questions

Look at the execution_table row 3. What response does port 443 send?

A RST

B SYN-ACK

C No response

D FIN

💡 Hint

Check the 'Response Received' column in row 3 of the execution_table.

At which step does Nmap determine port 80 is filtered?

A Step 1

B Step 2

C Step 4

D Step 5

💡 Hint

Look at the 'Port Status Determined' column for port 80 in the execution_table.

If port 22 sent a RST instead of SYN-ACK, what would its status be?

A Open

B Filtered

C Closed

D Unknown

💡 Hint

Refer to the pattern in execution_table row 3 where RST means closed.

Concept Snapshot

Nmap port scanning sends probe packets to target ports.
Responses show if ports are open (SYN-ACK), closed (RST), or filtered (no reply).
Common scan: 'nmap -sS target_ip' uses TCP SYN scan.
Results help find active services on a network.
Useful for security checks and network troubleshooting.

Full Transcript

Port scanning with Nmap works by sending small probe packets to specific ports on a target computer. Nmap waits for replies to see if the ports respond with SYN-ACK (open), RST (closed), or no response (filtered). For example, sending a SYN packet to port 22 and receiving SYN-ACK means the port is open. If no response comes from port 80, it is filtered (e.g., by a firewall). Receiving RST from port 443 means it is closed. This scanning method is called a TCP SYN scan and is stealthy because it does not complete the full connection. The scan ends after checking all target ports and then shows a summary of which ports are open, closed, or filtered. This helps users understand what services are running on the target and find security weaknesses.